T1037

Boot or Logon Initialization Scripts

Persistence Privilege Escalation Last updated:

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. On Windows, logon scripts can be set via the UserInitMprLogonScript registry value under HKCU\Environment, or via Group Policy. On Linux and macOS, adversaries target RC scripts (/etc/rc.d/, /etc/init.d/, /etc/rc.local), systemd unit files, login hooks, and startup items. These mechanisms execute with elevated privileges and survive reboots, making them effective persistence mechanisms. Threat groups including APT41, APT29, Rocke, and UNC3886 have all leveraged initialization script abuse, targeting both enterprise endpoints and network appliances.

What is T1037 Boot or Logon Initialization Scripts?

Boot or Logon Initialization Scripts (T1037) maps to the Persistence and Privilege Escalation tactics — the adversary is trying to maintain their foothold in MITRE ATT&CK.

This page provides production-ready detection logic for Boot or Logon Initialization Scripts, covering the data sources and telemetry it touches: Registry: Registry Key Modification, File: File Creation, File: File Modification, Process: Process Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Persistence Privilege Escalation
Technique
T1037 Boot or Logon Initialization Scripts
Canonical reference
https://attack.mitre.org/techniques/T1037/
Microsoft Sentinel / Defender
kusto 
let WindowsLogonScriptKeys = dynamic([
  "UserInitMprLogonScript",
  "\\Environment\\UserInitMprLogonScript"
]);
let LinuxInitPaths = dynamic([
  "/etc/rc.d/", "/etc/init.d/", "/etc/rc.local", "/etc/init/",
  "/etc/rc0.d/", "/etc/rc1.d/", "/etc/rc2.d/", "/etc/rc3.d/",
  "/etc/rc4.d/", "/etc/rc5.d/", "/etc/rc6.d/"
]);
let SuspiciousExtensions = dynamic([".sh", ".py", ".pl", ".rb", ".bash"]);
// Branch 1: Windows registry-based logon scripts
let WindowsLogonScript = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has "\\Environment" and RegistryValueName =~ "UserInitMprLogonScript"
| extend DetectionBranch = "Windows-LogonScript-Registry"
| extend Detail = strcat("Key: ", RegistryKey, " | Value: ", RegistryValueData)
| project Timestamp, DeviceName, AccountName, ActionType, RegistryKey,
          RegistryValueName, RegistryValueData, InitiatingProcessFileName,
          InitiatingProcessCommandLine, DetectionBranch, Detail;
// Branch 2: Suspicious file writes into Windows Startup / logon script paths
let WindowsStartupFile = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (
    "\\Windows\\System32\\GroupPolicy",
    "\\Windows\\SysWOW64\\GroupPolicy",
    "SYSVOL",
    "\\netlogon\\"
  )
| where FileName has_any (".bat", ".cmd", ".vbs", ".ps1", ".js", ".wsf")
| extend DetectionBranch = "Windows-StartupScript-FileCreate"
| extend Detail = strcat("File: ", FolderPath, "\\", FileName)
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
          ActionType, RegistryKey="", RegistryValueName="", RegistryValueData="",
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          DetectionBranch, Detail;
// Branch 3: Linux/macOS init script file creation (via Syslog/AuditLogs)
let LinuxInitScript = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (LinuxInitPaths)
| extend DetectionBranch = "Linux-InitScript-FileCreate"
| extend Detail = strcat("File: ", FolderPath, "/", FileName)
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
          ActionType, RegistryKey="", RegistryValueName="", RegistryValueData="",
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          DetectionBranch, Detail;
// Branch 4: macOS login hook configuration via 'defaults write'
let MacOSLoginHook = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "defaults"
| where ProcessCommandLine has "LoginHook" or ProcessCommandLine has "LogoutHook"
| extend DetectionBranch = "macOS-LoginHook-Configured"
| extend Detail = ProcessCommandLine
| project Timestamp, DeviceName, AccountName,
          ActionType="ProcessCreate", RegistryKey="", RegistryValueName="", RegistryValueData="",
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          DetectionBranch, Detail;
union WindowsLogonScript, WindowsStartupFile, LinuxInitScript, MacOSLoginHook
| sort by Timestamp desc

Detects Boot or Logon Initialization Script abuse across Windows, Linux, and macOS. Uses four detection branches: (1) Registry modifications to HKCU\Environment\UserInitMprLogonScript for Windows per-user logon scripts; (2) Script file creation in Windows Group Policy and NETLOGON directories used for network logon scripts; (3) File creation in Linux RC and init.d directories targeted by malware like RotaJakiro, Rocke, and VIRTUALPITA; (4) macOS login hook configuration via the 'defaults write' command targeting LoginHook and LogoutHook keys.

high severity medium confidence

Data Sources

Registry: Registry Key Modification File: File Creation File: File Modification Process: Process Creation Microsoft Defender for Endpoint

Required Tables

DeviceRegistryEvents DeviceFileEvents DeviceProcessEvents

False Positives

  • Group Policy administrators deploying legitimate logon scripts via SYSVOL/NETLOGON shares during policy updates
  • Configuration management tools (Ansible, Chef, Puppet, SCCM) writing startup scripts to managed endpoints as part of authorized deployments
  • Linux package managers (apt, yum, dnf, rpm) creating init.d service scripts when installing server software (nginx, apache, mysql)
  • System administrators manually configuring logon scripts for mapped drives, printer connections, or environment variable setup
  • macOS enterprise MDM solutions (Jamf, Mosyle) configuring LoginHooks for device enrollment or management tasks

Sigma rule & cross-platform mapping

The detection logic for Boot or Logon Initialization Scripts (T1037) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1037 Sigma rules on detection.fyi

Platform-specific guides for T1037

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-16 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Windows Logon Script via UserInitMprLogonScript Registry

    Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=%TEMP%\argus-test-logon.bat, Image=reg.exe. Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\argus-test-logon.bat. DeviceRegistryEvents in MDE will show ActionType=RegistryValueSet with RegistryValueName=UserInitMprLogonScript.

  2. Test 2Linux RC Script Persistence via init.d

    Expected signal: Linux auditd SYSCALL=openat/write with name=/etc/init.d/argus-test and exe=bash or exe=tee. Syslog entries for update-rc.d execution. If auditd rule -w /etc/init.d -p wa -k init_script_write is in place, ausearch will return the creation event with auid, uid, pid, and full command context. File creation timestamp visible via stat /etc/init.d/argus-test.

  3. Test 3macOS Login Hook Configuration

    Expected signal: Sysmon for macOS Event ID 1 (Process Create): Image=defaults, CommandLine contains 'write com.apple.loginwindow LoginHook'. File create event for /tmp/argus-loginhook.sh. MDE DeviceProcessEvents will show FileName=defaults with ProcessCommandLine referencing LoginHook. On execution at next login: launchd spawning the hook script as parent.

  4. Test 4Windows Network Logon Script via Group Policy INI

    Expected signal: Sysmon Event ID 11 (File Create): TargetFilename in %SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\ with .bat extension. DeviceFileEvents ActionType=FileCreated for both the script and scripts.ini. Security Event ID 4688 (cmd.exe executing mkdir and echo). On next logon: userinit.exe spawning the script from the GroupPolicy Scripts directory.

Response Playbook

Triage

  1. Identify the detection branch that fired — Windows registry logon script, Group Policy file drop, Linux init.d modification, or macOS login hook — each has distinct triage steps
  2. For Windows UserInitMprLogonScript: examine the RegistryValueData to see what script or binary is configured to run. Is the path to a known-good script or an unusual location (temp dir, user profile, appdata)?
  3. Correlate the modification time with user activity — was the registry/file change made interactively by a logged-on user, or by a background process/service with no corresponding user session?
  4. Identify the initiating process: was the change made by cmd.exe, powershell.exe, a browser process, a macro-enabled Office document, or a service account? Parent process matters — malware typically drops these from post-exploitation shells
  5. For Linux init.d modifications: check file ownership (root vs non-root), permissions (ls -la), and content (cat or strings on binary) of the newly created init script. Malicious scripts often contain base64-encoded payloads or curl/wget commands
  6. Check whether the script or binary pointed to by the initialization entry already exists on disk. A registry key pointing to a non-existent file may indicate an incomplete deployment or a dropped-and-deleted staging artifact
  7. Review recent user logon activity (Event ID 4624) to determine if the script has already executed — if the system has been rebooted or a user has logged on since the script was configured, execution may have already occurred

Containment

  1. If active malicious script execution is confirmed: isolate the endpoint immediately using EDR network isolation before the next boot/logon cycle triggers re-execution
  2. Remove or disable the persistence entry: on Windows, delete the UserInitMprLogonScript registry value (reg delete HKCU\Environment /v UserInitMprLogonScript /f); on Linux, remove the malicious init script and run update-rc.d <script> remove or systemctl disable
  3. Preserve the malicious script/binary before deletion by copying to an evidence share — do not delete without capturing a hash and copy for forensic analysis
  4. If the logon script references a network share (UNC path), block access to that share immediately and investigate whether other systems have already executed the script
  5. Reset credentials for any accounts that have logged on since the script was planted — logon scripts run in user context and may have harvested credentials or established persistence under that account
  6. Scan all other endpoints in the environment for the same persistence entry, particularly if the script was deployed via Group Policy (SYSVOL/NETLOGON paths indicate policy-wide distribution)

Evidence Collection

  1. Windows Registry export: reg export HKCU\Environment C:\evidence\UserInitMprLogonScript.reg — captures the full registry key with timestamp
  2. Sysmon Event ID 13 logs from the Microsoft-Windows-Sysmon/Operational channel — contains RegistryKey, TargetObject, Details (new value), and InitiatingProcess fields
  3. File system copy of the malicious script with hash: Get-FileHash <script_path> -Algorithm SHA256 | Export-Csv C:\evidence\script_hash.csv
  4. Windows Security Event ID 4688 or Sysmon Event ID 1 — process creation events from the time window around script installation to identify the delivery mechanism
  5. For Linux: /var/log/auth.log and /var/log/secure for su/sudo activity around the time of file creation; auditd logs (ausearch -f /etc/init.d/) for complete audit trail
  6. Group Policy processing logs (Event ID 4006 from Microsoft-Windows-GroupPolicy/Operational) to determine if policy-distributed scripts were involved
  7. macOS: com.apple.loginwindow plist from /var/db/com.apple.xpc.launchd/ and results of 'defaults read com.apple.loginwindow LoginHook' to capture hook configuration
  8. Memory acquisition if script has already executed — use EDR memory capture or WinPmem to look for injected code or C2 implants loaded via the init script

Escalation Criteria

  • ! The init script contains or fetches a second-stage payload (base64 encoded content, curl/wget to external IP, certutil download)
  • ! The persistence mechanism has already executed — evidence includes network connections from script runtime, new processes, or modified files created at boot/logon time
  • ! The script was planted via Group Policy (SYSVOL/NETLOGON path) — this indicates domain-level compromise and potential mass lateral movement across all domain members
  • ! Script runs as SYSTEM or root — initialization scripts running with privileged context enable privilege escalation if combined with writable paths
  • ! Multiple endpoints share the same malicious init script entry — indicates automated deployment via C2, worm-like propagation, or compromised GPO
  • ! The technique matches known threat group TTPs: APT41 (hidden shell scripts in /etc/rc.d/init.d/), Rocke (cryptominer persistence via init.d), UNC3886 (FortiManager /etc/init.d/localnet tampering)

Investigation Guide

Forensic Artifacts

  • > Windows Registry: HKCU\Environment\UserInitMprLogonScript — per-user logon script value; HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit — system-wide user init configuration
  • > Windows File System: %SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\ and Logoff\ — local GPO script directories; \\<domain>\SYSVOL\<domain>\Policies\<GUID>\User\Scripts\scripts.ini — domain GPO script assignments
  • > Windows Event Log: Microsoft-Windows-GroupPolicy/Operational Event ID 4006 (script processing), Event ID 4007 (script processing failed) — show script execution timing and failures
  • > Linux File System: /etc/init.d/<script>, /etc/rc.local, /etc/rc.d/rc<N>.d/S<XX><script> symlinks — persistence locations; check modification timestamps with stat and ls -la --full-time
  • > Linux Audit Log: /var/log/audit/audit.log — auditd records for SYSCALL write/open/rename on init paths; parse with aureport -f or ausearch -f /etc/init.d/
  • > macOS Plist: /var/db/com.apple.xpc.launchd/ — contains login hook state; com.apple.loginwindow plist under /Library/Preferences/; results of 'defaults read com.apple.loginwindow LoginHook'
  • > macOS File System: /Library/StartupItems/ and /System/Library/StartupItems/ — legacy startup item bundles containing StartupParameters.plist and executable scripts
  • > Network Devices: startup-config file (show startup-config on Cisco IOS) — UNC3886 targeted /etc/init.d/localnet in FortiManager rootfs.gz; check for unexpected commands in initialization sequences

Tuning Guidance

The highest false positive source for Windows logon script detection is legitimate IT administration — helpdesk teams and sysadmins frequently configure UserInitMprLogonScript for drive mapping or environment setup. Build an allowlist of approved initiating processes (gpupdate.exe, gpedit.msc, specific admin tools) and known script paths (e.g., \\domain\SYSVOL\). For Linux, the primary noise source is package manager activity — filter by InitiatingProcessFileName to exclude dpkg, rpm, apt, yum, dnf, and their wrapper scripts. Consider adding auditd rules specifically for /etc/init.d/ write access (key=init_script_write) to get structured audit events with auid tracking rather than relying on syslog pattern matching. For macOS, LoginHook alerts will almost exclusively be MDM-related in managed environments — coordinate with your MDM team to enumerate expected LoginHook values. If your environment has a known-clean baseline for init script contents, consider implementing file integrity monitoring (FIM) on /etc/init.d/ and /etc/rc.d/ paths to alert on any modification regardless of the creating process, rather than relying solely on process-based detection. For network devices (FortiManager, FortiAnalyzer), baseline the startup config and alert on any modification — UNC3886's technique of modifying /etc/init.d/localnet within rootfs.gz archives requires firmware-level analysis outside standard SIEM telemetry.

Hunting Queries

Hunt for any historical or recurring modifications to the UserInitMprLogonScript registry value over the past 30 days. Aggregates by account and initiating process to surface automated or scripted deployments. A single account setting this value across multiple devices is a strong lateral movement indicator.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(30d)
| where RegistryValueName =~ "UserInitMprLogonScript"
| summarize Count=count(), UniqueDevices=dcount(DeviceName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), ScriptValues=make_set(RegistryValueData) by AccountName, InitiatingProcessFileName
| order by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
  TargetObject="*UserInitMprLogonScript*"
| stats count as Count, dc(host) as UniqueDevices, earliest(_time) as FirstSeen, latest(_time) as LastSeen, values(Details) as ScriptValues by User, Image
| sort - Count

Hunt for non-package-manager processes writing to Linux init script directories over the past 30 days. Package managers (dpkg, rpm, yum, apt) are expected to write here; other processes writing to these paths warrant investigation. Covers Rocke, VIRTUALPITA, RotaJakiro, and APT41 init.d persistence patterns.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(30d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any ("/etc/init.d/", "/etc/rc.d/", "/etc/rc.local", "/etc/init/")
| where InitiatingProcessFileName !in~ ("dpkg", "rpm", "yum", "apt", "apt-get", "dnf", "installer", "packagekit")
| summarize FileCount=count(), UniqueFiles=make_set(FileName), Devices=dcount(DeviceName) by InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileCount > 0
| order by FileCount desc
Hunting — SPL
spl 
index=linux sourcetype=linux_auditd
  (name="/etc/init.d/*" OR name="/etc/rc.d/*" OR name="/etc/rc.local" OR name="/etc/init/*")
  (syscall=write OR syscall=open OR syscall=rename OR syscall=creat)
| where NOT match(exe, "(dpkg|rpm|yum|apt|dnf|installer|packagekit)")
| stats count as WriteCount, values(name) as Files, dc(host) as Devices by exe, auid
| sort - WriteCount

Hunt for processes spawned directly by OS initialization parents (userinit.exe, winlogon.exe, launchd, init, systemd) that reference known init script paths in their command lines. This identifies scripts already configured and actively executing at boot/logon, rather than just the configuration step.

Hunting — KQL
kql 
let InitScriptExecPatterns = dynamic(["/etc/init.d/", "/etc/rc.local", "UserInitMprLogonScript",
  "LoginHook", "StartupItems"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any (InitScriptExecPatterns)
   or FolderPath has_any ("/etc/init.d/", "/Library/StartupItems/")
| where InitiatingProcessFileName in~ ("launchd", "init", "systemd", "rc", "userinit.exe", "winlogon.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog OR index=linux sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype=syslog EventCode=1
| where (match(CommandLine, "(?i)(/etc/init\.d/|/etc/rc\.local|UserInitMprLogonScript|LoginHook)"))
  OR (match(ParentImage, "(?i)(userinit\.exe|winlogon\.exe|launchd|init|systemd)"))
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Windows Logon Script via UserInitMprLogonScript Registry
windows

Sets the UserInitMprLogonScript registry value under HKCU\Environment to point to a benign script. This is the Windows per-user logon script mechanism — the configured script executes at every user logon via userinit.exe. This technique requires only user-level privileges and survives reboots.

Command

powershell 
reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "%TEMP%\argus-test-logon.bat" /f
echo @echo off > %TEMP%\argus-test-logon.bat
echo echo Argus logon script test >> %TEMP%\argus-test-logon.bat

Cleanup

powershell 
reg delete "HKCU\Environment" /v UserInitMprLogonScript /f
del /f %TEMP%\argus-test-logon.bat

Expected Telemetry

Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=%TEMP%\argus-test-logon.bat, Image=reg.exe. Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\argus-test-logon.bat. DeviceRegistryEvents in MDE will show ActionType=RegistryValueSet with RegistryValueName=UserInitMprLogonScript.

Expected Detection

KQL WindowsLogonScript branch fires: RegistryValueName matches UserInitMprLogonScript. SPL EventCode=13 branch fires on TargetObject match. DetectionBranch=Windows-LogonScript-Registry.

Test 2 Linux RC Script Persistence via init.d
linux

Creates a benign shell script in /etc/init.d/ and registers it with update-rc.d to execute at runlevel startup. This technique is used by Rocke (cryptominer persistence), VIRTUALPITA (vCenter persistence), and RotaJakiro (Linux backdoor). Requires root privileges.

Command

bash 
sudo bash -c 'cat > /etc/init.d/argus-test << EOF
#!/bin/bash
### BEGIN INIT INFO
# Provides:          argus-test
# Required-Start:    \$remote_fs \$syslog
# Required-Stop:     \$remote_fs \$syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Argus persistence test
### END INIT INFO
echo "Argus test executed at \$(date)" >> /tmp/argus-init-test.log
export PATH=\$PATH
EOF
chmod +x /etc/init.d/argus-test'
sudo update-rc.d argus-test defaults

Cleanup

bash 
sudo update-rc.d argus-test remove
sudo rm -f /etc/init.d/argus-test
rm -f /tmp/argus-init-test.log

Expected Telemetry

Linux auditd SYSCALL=openat/write with name=/etc/init.d/argus-test and exe=bash or exe=tee. Syslog entries for update-rc.d execution. If auditd rule -w /etc/init.d -p wa -k init_script_write is in place, ausearch will return the creation event with auid, uid, pid, and full command context. File creation timestamp visible via stat /etc/init.d/argus-test.

Expected Detection

SPL linux_auditd branch fires on syscall write to /etc/init.d/ path. KQL LinuxInitScript branch fires if MDE Linux agent is deployed and monitors /etc/init.d/ via DeviceFileEvents.

Test 3 macOS Login Hook Configuration
macos

Configures a macOS Login Hook using the 'defaults write' command targeting com.apple.loginwindow. Login hooks execute as root at user login and persist across reboots. This technique was used by various macOS malware families for persistence. Requires administrator privileges.

Command

bash 
cat > /tmp/argus-loginhook.sh << 'EOF'
#!/bin/bash
echo "Argus LoginHook test at $(date)" >> /tmp/argus-loginhook.log
EOF
chmod +x /tmp/argus-loginhook.sh
sudo defaults write com.apple.loginwindow LoginHook /tmp/argus-loginhook.sh

Cleanup

bash 
sudo defaults delete com.apple.loginwindow LoginHook
rm -f /tmp/argus-loginhook.sh /tmp/argus-loginhook.log

Expected Telemetry

Sysmon for macOS Event ID 1 (Process Create): Image=defaults, CommandLine contains 'write com.apple.loginwindow LoginHook'. File create event for /tmp/argus-loginhook.sh. MDE DeviceProcessEvents will show FileName=defaults with ProcessCommandLine referencing LoginHook. On execution at next login: launchd spawning the hook script as parent.

Expected Detection

KQL MacOSLoginHook branch fires on FileName=defaults with ProcessCommandLine has LoginHook. SPL macOS branch fires on Image=*/defaults CommandLine=*LoginHook*. DetectionBranch=macOS-LoginHook-Configured.

Test 4 Windows Network Logon Script via Group Policy INI
windows

Simulates a network logon script deployment by writing a script reference to the local Group Policy scripts.ini file — the same mechanism used when a domain GPO configures logon scripts distributed via SYSVOL. This represents T1037.003 (Network Logon Script) behavior in a local context.

Command

powershell 
mkdir -p "%SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon"
echo @echo off > "%SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\argus-gpo-test.bat"
echo echo Argus GPO logon script test >> "%SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\argus-gpo-test.bat"
(echo [Logon] & echo 0CmdLine=argus-gpo-test.bat & echo 0Parameters=) > "%SYSTEMROOT%\System32\GroupPolicy\User\Scripts\scripts.ini"

Cleanup

powershell 
del /f "%SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\argus-gpo-test.bat"
del /f "%SYSTEMROOT%\System32\GroupPolicy\User\Scripts\scripts.ini"

Expected Telemetry

Sysmon Event ID 11 (File Create): TargetFilename in %SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\ with .bat extension. DeviceFileEvents ActionType=FileCreated for both the script and scripts.ini. Security Event ID 4688 (cmd.exe executing mkdir and echo). On next logon: userinit.exe spawning the script from the GroupPolicy Scripts directory.

Expected Detection

KQL WindowsStartupFile branch fires on FolderPath has GroupPolicy and FileName has .bat. SPL EventCode=11 branch fires on TargetFilename matching \\GroupPolicy\\.*\.bat pattern. DetectionBranch=Windows-StartupScript-FileCreate.

Related Detections

Tactic Hubs

TA0003PersistenceTA0004Privilege Escalation

Sub-techniques (5)

Related Techniques

T1037.001Logon Script (Windows)T1037.002Login HookT1037.003Network Logon ScriptT1037.004RC ScriptsT1037.005Startup ItemsT1543Create or Modify System ProcessT1546Event Triggered ExecutionT1053.005Scheduled TaskT1059.004Unix ShellT1222.002Linux and Mac File and Directory Permissions Modification

Same Tactic: Persistence

Popular Detections